Privacy policy

1. What we collect

Account data

Your email, the name you enter, a hashed password (we never see the real one), your language and time zone, and when you accepted this policy. If you sign in with Google we also store your Google account reference.

Data you create

Tanks, fish, schedules, completed-task records, water logs, uploaded photos, and any community content you post (questions, answers, comments, diaries).

Technical data

Your IP address and sign-in times, kept only to stop password guessing and abuse, plus a log of whether each notification was delivered.

We do not store card details, do not track you across other websites, and run no third-party advertising or analytics scripts.

2. Why we use it

We use your data only for the following purposes.

To provide the service you asked for — remembering your schedule and sending reminders on time.
To sign you in and keep your account secure.
To contact you about your account, such as email verification or a password reset.
To keep public content free of spam and abuse.

The legal bases are performance of our agreement with you, and the consent you gave when you signed up.

We do not sell your data, and share it only where the service requires it.

ntfy — only if you turn it on. Notification messages go to the server and topic you enter. Tank task reminders contain your tank name, task name, time, the task details you entered (such as the food or the medicine dose) and a link for marking the task done. Note that ntfy topics are public names: anyone who knows the topic can read its messages, so use a long random one.
ntfy (orders, private chat and listings) — if you have ntfy turned on, a short message goes to the same topic when there is an update on your order, a private chat, a listing or your seller status. It only says what kind of thing happened, for example “You have a new private message”, with a link to the site that requires sign-in. It never contains message text, the other person’s name, addresses, phone numbers, order codes or amounts. You can turn off just this part in your notification settings and still get tank task reminders.
Our email provider — used to send verification and password reset messages.
Our hosting provider — where the database and files live.
Government authorities — only under a lawful order.

4. What other people can see

Most of the system is private to you: your tanks, fish, schedules and water logs. Only what you deliberately publish is visible to others.

Questions and answers on the Q&A board are readable by everyone, including people without an account.
Diaries are always private until you switch one to public yourself. When you do, every entry and photo in that diary becomes visible to everyone.
Your profile page is off by default, and your email address is never shown publicly under any setting.
Uploaded photos have their EXIF data stripped automatically, including the GPS location that phone cameras embed.

5. How long we keep it

Account data and the data you create are kept for as long as your account is active.
When you delete your account, notifications stop immediately and everything is permanently deleted within 30 days.
Notification delivery logs are kept for 180 days so problems can be traced.
Questions, answers and comments you posted publicly remain after account deletion but no longer show your name, because those answers are useful to people who read them later. Diaries are deleted in full, because they are personal to you.

5.1 Chat rooms, blocking and reports

This applies once the team opens chat rooms. Messages are stored as the text you type; there are no images in chat, and the site never opens the links you send to build previews.

Chat room messages are visible only to signed-in members and the team, and are deleted automatically after 180 days unless a report about them is still open.
Messages you delete or unsend disappear for everyone straight away, but their text is kept for 30 more days in case someone reports them, then erased.
When someone reports a message, a copy of that message and up to 3 earlier ones is saved for the team to review. The copy is erased 365 days after the report is closed. The reported person is not told who reported them, and the reporter is not told the outcome.
Only you can see the list of people you block. Blocked people are not told. The list stays until you unblock them or delete your account.
If you delete your account, messages you sent in chat rooms remain until the retention period above ends but no longer show your name, your name is removed from message copies attached to reports when the account is finally erased, and your block list is deleted with the account.
Your data export includes the messages you sent and the people you blocked. It does not include other people's messages, who blocked you, or reports other people made about you.

5.2 Private chat

This applies once the team turns on private chat, a conversation between two people. Messages are stored as the text you type; there are no images in chat, and the site never opens the links you send to build previews.

Only you and the person you are talking with can read a private chat. The team and the site owner have no page for opening anyone's private chats.
If you or the other person reports a message, a copy of that message and up to 3 earlier messages from the same chat is saved. The team sees only this copy and may lock the chat so it can only be read. The copy is erased 365 days after the report is closed.
A private chat is deleted automatically, with all its messages, when no new message has been sent for 365 days, unless a report about it is still open.
You can unsend a message within 15 minutes. Both of you then see that it was unsent, but its text is kept for 30 more days in case someone reports it, then erased.
Notifications on the site show only the name of the person who wrote, never the message itself. If you have ntfy turned on, the message sent to ntfy only says that you have a new private message, with no sender name and no message text. The other person can see how far you have read. The warning about bank account numbers under a message is worked out when the page is shown and is never saved or sent anywhere.
If you delete your account, nobody can send you private messages from then on. When the account is finally erased (30 days after you delete it), the text of every private message you sent is erased: the other person sees unsent messages from a deleted user, and the whole chat is deleted 30 days after that.
Your data export includes the private messages you sent, including unsent ones whose text has not been erased yet, and the chats you are in with your own settings (how far you have read, muted, hidden). It does not include messages other people sent you, because those belong to them.

5.3 Lamtharn shop: orders, addresses and transfer slips

This applies once the team opens the Lamtharn shop. You pay by PromptPay QR transfer straight into the shop's bank account. The site never sees or stores your account number, banking app password or card details.

The recipient name, phone number, address, postcode and note are used for delivery only. The team sees the address after your payment is confirmed. These details and the tracking number are erased 90 days after the order is completed, cancelled or expired; only the first word of the recipient name and the province are kept.
Slip images are kept in private storage that cannot be opened directly from the web. Only you and the team members who check payments can see them, and every time the team opens a slip it is logged. The image file is deleted 180 days after the order is closed.
Messages in an order, such as questions or the PromptPay number for a refund, are visible only to you and the team, and are erased together with the address 90 days after the order is closed.
While an order is waiting for payment review, waiting to ship, or waiting for a refund, its contact details and messages are kept until the order is closed, because the team still needs them to ship or refund. The periods above start when the order is closed.
Order amounts, items and dates are kept for 5 years as accounting records, without addresses, phone numbers, messages or slip images.
If you delete your account, orders you have not attached a slip to are cancelled straight away. Orders with a slip or a confirmed payment are still reviewed, shipped or refunded by the team. When the account is finally erased, contact details on closed orders are erased and sales records are kept without identifying you.
Your data export includes your orders, their items, the messages you wrote in them and slip details (status, size, time), but not slip images or the team's replies.

5.4 Second-hand market: members' listings

This applies once the team opens the second-hand market, where members with selling permission list items for each other. The site does not buy or sell anything itself, never holds money for anyone, does not see payments and is not a party to any sale. Buyers and sellers talk and agree between themselves in private chat; anything you share there is kept as described in 5.2.

Everyone can see a listing's title, description, price, photos, province, pickup or postage options, the seller's display name, when they joined and how many items they have sold. Listings that are for sale also appear on your profile page, even if your profile is closed. Your e-mail, address and phone number are never shown and there is no address field. If you type a phone number, LINE ID or bank account into a listing yourself, everyone can read it.
Your selling permission record (when you asked for it, when it was granted or removed, which team member did it, the note the team wrote to you, and when you confirmed you are 20 or older and accepted the market rules) is visible only to you and the team. If your permission is removed, your listings leave the market at once but stay in My listings.
Members' listings are checked by the team before they go on the market. The system adds warning labels in the review queue when it finds a phone number, LINE ID, bank account, link, e-mail address or words about prohibited items. Only the team sees these labels, and nothing is sent anywhere.
A listing lasts 30 days. A notification reminds you 3 days before it expires. Expired listings leave the market; you can renew or relist them from My listings.
For closed listings (sold, withdrawn, expired, or rejected and not edited since), photos are deleted 90 days after the listing closed or was last edited, and the listing itself is deleted 365 days after it closed. Listings with an open report are kept until the team has finished checking them.
When you delete a listing it disappears at once from the market and from My listings, and its photos are deleted straight away. If a report about it is still open, the photos are kept for the team until the report is closed and are deleted in the next daily clean-up. The details of a deleted listing are removed from the system after 365 days.
If someone reports a listing, a copy of its title, price and description is saved for the team. The team may hide the listing or remove the selling permission. The seller is not told who reported it. The copy is erased 365 days after the report is closed.
If you delete your account, all your listings leave the market straight away. When the account is finally erased (30 days after you delete it), your listings, their photos and your selling permission record are deleted. Only for listings someone reported, the team keeps a copy of the title, price and description as evidence until the report retention above ends, without photos and without your identity.
Your data export includes every listing still in the system, including closed or deleted ones whose retention period has not ended, and your selling permission record. It does not include the photo files or reports other people made about your listings.

6. Your rights

Under the PDPA you have the following rights, and you can exercise most of them yourself under Settings → Account.

Access and obtain a copy of your data — export it yourself at any time as a complete JSON file.
Correct inaccurate data — edit it yourself in settings.
Erase your data — delete your account yourself.
Withdraw consent, object to processing, or ask us to restrict it.
Complain to the Personal Data Protection Committee if you believe we have handled your data wrongly.

7. Cookies

We use only the cookies the site needs to work. There are no advertising or tracking cookies.

Session cookie — remembers that you are signed in; it expires when you sign out or after 14 days without a visit, and the site asks you to sign in again every 90 days.
Language cookie — remembers whether you chose Thai or English; kept for one year.

8. Security

Passwords are hashed with a standard algorithm before being stored, connections are forced to HTTPS, sign-in links expire and work only once, and sign-in attempts are rate limited to stop password guessing. No system is perfectly secure, so using a password you do not reuse elsewhere still matters.

9. Children

This service is not designed for children under 13. Minors should have a guardian’s consent before using it.

10. Changes to this policy

If we make a material change to this policy we will announce it in the app before it takes effect.

11. Contact about your data

If you have a question about this policy, or want to exercise a right the system cannot handle automatically, use the contact channel below, or the one on the About page.

Contact channel: Message the shop on LINE